Privacy Statement Jira & Confluence

Version 19-12-2023

In this privacy statement, we explain what happens to your personal data when it is processed while using the agile tooling Jira & Confluence.”

Who is responsible for processing my personal data?

Utrecht University, located at Heidelberglaan 8, 3584 CS Utrecht, is responsible for the communications described in this privacy statement. 

For what purposes are my personal data processed?

The purpose of Agile tools like Jira and Confluence is to streamline project management by promoting collaboration and communication within Agile teams. These tools facilitate the Agile working method within Utrecht University and enable more efficient planning, focused task management, and enhance information sharing within teams.

Jira is a tool that allows teams to track issues and manage projects. It can be used for both Agile other project management methods to track bugs, features, and other work items.

Confluence Cloud enables users to consolidate all their information, documents, and projects into one organized space. This allows teams to easily and quickly find, search, and discover information.

Which personal data are processed?

The following data is processed when you use Jira and/or Confluence:

• User account data:
  • Unique Atlassian ID;
  • Text in ‘About Me’;
  • Avatar & URL;
  • First and last name;
  • Email address;
  • Time zone.
• Employment information:
  • Job title/role;
  • Office/location;
  • Company/organization.
• Other:
  • Personal data included in content generated by users.

For how long will the UU keep my personal data?

The data is retained as long as the user maintains an active Jira/Atlassian account. Upon termination of the subscription period, customer accounts are deactivated after 17 days. Atlassian retains data for deactivated products for either 15 days (for evaluation licenses) or 60 days (for free, Standard, and Premium product subscriptions) after the end of the current subscription period. After deletion, an archive of the data is kept for an additional 30 days.

What is the legal basis?

We only process your personal data if there is a basis for this. These are as follows:

To offer Agile tooling to our employees:

The basis for this processing is the legitimate interest. The UU has a interest in providing suitable (Agile) tools to its employees so that they can effectively work according to the Agile method, where the use of such collaboration tools is integrated into the method. To make this possible, it is necessary to process a limited set of personal data, for example, to verify one’s identity and to grant access and rights to pages to the appropriate employees. No more personal data is collected than necessary for the intended purpose of the processing.

With whom will my personal data be shared?

Atlassian offers its products as a cloud service, therefore acting as a data processor for the data within Jira and Confluence on behalf of the University of Utrecht. A data processing agreement has been established between the University of Utrecht and Atlassian.

Atlassian maintains an up-to-date list of sub-processors they utilize to provide the services of Jira and Confluence on the following page: https://www.atlassian.com/legal/sub-processors

Will my data be shared outside the EEA?

Based on the list of sub-processors provided by Atlassian, personal data is processed by sub-processors located in America, Brazil, and Mexico. The (personal) data, both ‘in transit’ and ‘at rest,’ is encrypted for both Jira and Confluence.

Automated decision making

There is no automated decision making during the this processing.

What rights under the GDPR do I have?

When processing your personal data, you have a number of rights, such as the right of access, the right to rectification, the right to restrict processing and the right to not be subject to a decision based solely on automated processing. You can also request to have your data deleted. However, this is only possible to the extent that UU can still meet its legal obligations. And finally, in some cases you have the right to have an entire set of data that we have about you transferred to another organization. This is called the right to portability. For more information about your GDPR rights, please refer to the general privacy statement for employees.

You can submit your request via the this Topdesk form.

Contact and complaint options

Do you have any specific questions or comments about our Privacy Statement based on this information? Please feel free to contact us. You can use the contact form on the website or send an e-mail to privacy@uu.nl. If you want to file a complaint, you can send an e-mail to our Data Protection Officer at fg@uu.nl. You also have the right to file a complaint with the Dutch Data Protection Authority about the use of your personal data. This can be done via the following link: https://www.autoriteitpersoonsgegevens.nl/een-tip-of-klacht-indienen-bij-de-ap.

This Privacy Statement was last changed on October 31th, 2023. The UU reserves the right to make changes to this Privacy Statement where necessary.